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Network 
Station 
Receives 
Packet 

wiith 
HeaUe* — 



\ 5"0 Network Station 
~ (e.g., router, switch, 

gateway, network computer 
having server or client logic, 
etc. ) 



^ Start ^ 



-10 0 



Obtain Complete, Ordered, Access 
Control List (ACL) Where the 
Order is That Specified by a 
Network Administrator 



"Hash-Table-Balancing Bit 
Selection Vector" which has one 
or more pointers which point to 
bit positions, within fields of 
packet headers utilized by rules 
of the ACL, which will be used 
to construct one or more hash 

table index values which 
substantially guarantee that a 
yet-to-be-constructed Balanced 
Hash Table of ACL Binary 
Comparison Trees will be 
substantially balanced 









no 


Balanced Hash 




Table of ACL 




Binary 




Comparison 




Trees, 






hereinafter 






referred to as 






"Balanced Hash 




Table of ABCTs, " 




where the 




Balanced Hash 




Table Encodes 




the ACL 





Per-Packet Processing Engine i 
/Hash-Table-Balancing Bit Selection^ 
Vector to form a hash table index 
I value from the packet header fields, 
and uses the hash table index value 
| to "key into" the Balanced Hash Table) 
of ABCTs; thereafter, a walk of the 
Balanced Hash Table of ABCTs is 

performed to determine the 
disposition appropriate to the 
received packets 



114 



Walk of Balanced Hash Table 
of ABCTs Results in 
Disposition of Packet in 
Manner Mandated by ACL 



FIG. 1A 
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^ START 



30V 



Obtain complete, ordered, ACL 
of access control rules for 
network member, the obtained 
rules, being in an order 
specified by network 
administrator . 



T 



Iden t i f y Packet 
Header Fields 
Utilized by ACL Rules 
in the ACL 
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Scan each ACL Rule in the complete, ordered, ACL and 
construct an exemplar bit string, where the exemplar bit 
string has one field for each Packet Header Field utilized at 
least once by any ACL Rule in the ACL and such that no fields 
are duplicated within the exemplar - " 



For Each ACL Rule, Construct and Store a Bit String 

Modeled Upon the Exemplar Bit String, where the 
Constructed Bit String for Each Such ACL Rule Will 

Contain the Contents of any Packet Header Fields 
Utilized by Each Such ACL Rule and Don't Care ("X") 
bits as the contents of fields not utilized by each 
such ACL rule 












Specify bit length, or number of 
bits, of the index which will be 
utilized to "key into" a yet-to-be- 
constructed Balanced Hash Table of 
ABCTs 
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Using a heuristic balancing process, select a 
number of bit positions within the bit strings, 

constructed for and associated with each ACL 
rule, such that the number of bits selected is 
equal to the number of bits in the hash table 
index and such that the bit positions selected 
are those positions in which the bits utilized by 
the ACL rules appear relatively most frequently 
and which have mostly equal variation between 
zeros and ones; Set Hash-Table-Balancing Bit 
Selection Vector to Point to the Selected Bit 
Positions 



FIG. 2 



^ STOP ^ 
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Obtain Each" 
Bit String 
Constructed 
For Each ACL 
Rule In The 
ACL 



Si 



Align Each Obtained Constructed 

Bit String With Every Other 
Constructed Bit String Such That 
Like Fields, And Bits Contained 
Within Those Like Fields, Of Each 
Constructed Bit String Align with 
Each Other 



Set Current Al igned 
Bit Position To Be 
The Leftmost Bit 
Position Of The 
Aligned Constructed 
Bit Strings 



Count 


And 


Record 


The 


Number 


Of 


"0-S In 


The 


Current 


Aligned 


Bit 


Position 


Count 


And 


Record 


The 


Number 


Of 


"1-S In 


The 


Current 


Aligned 


Bit 


Position 


Count 


And 


Record 


The 


Number 


Of 


"X-S In 


The 


Current 


Aligned 


Bit 


Position 




V-1>H 



CD 



Construct A "Larger Total Count" Row, Where 
The Larger Total Count Row Has One Column For 

Each Bit Position Corresponding To The Bit 
Positions Of The Exemplar Bit String (or the 
Bit Positions of Each Constructed Bit String 
Built on the Basis of the Exemplar Bit String) 
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Fill Each Column Of The Larger Total Count Row 
With The Larger Of Either The Total Count Of "0"S 
+ "X-S Or The Total Count Of "1*'S + *X"S For The 
Bit Position Corresponding To Each Such Column Of 
The Larger Total Count Row 



l?0 



Construct A "Smaller Total Count* Row, Where The 
Smaller Total Count Row Has One Column For Each 
Bit Position Corresponding To The Bit Positions 
Of The Exemplar Bit String {or the Bit Positions 
of Each Constructed Bit String Built on the Basis 
of the Exemplar Bit String) 



Fill Each Column Of The Smaller Total Count Row 
With The Smaller Of Either The Total Count Of 
"0*S + "X-S Or The Total Count Of "1" 'S + "X'S 
For The Bit Position Corresponding To Each Such 
Column Of The Smaller T otal Count Row 



Set "Number of Unspecified Pointers 

of the Hash-Table-Balancing Bit 
Selection Vector" Equal to Specified 
Bit Length of 'Hash Table Index 



Select The One Or More Columns Of The Larger 
Total Count Row Having The Smallest Or Minimum 

Value Entries, And Designate Those Columns 
Having The Smallest Or Minimum Value Entries As 
Potential, *P, * candidate columns 




Attempt To Refine The Selection By Examining The One Or 
More Columns Of The Smaller Total Count Row, Such Examined 
Smaller Total Count Row Columns Being Those Corresponding 

To The Columns Currently Designated As Potential, "P.* 
Candidate Columns Within The Larger Total Count Row, And 
Redesignate as Potential, "R, " candidate columns To Be 
Those Examined Columns Within The Smaller Total Count Row 
With The Minimum, Or Smallest, Entries 
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FIG. 3A 




specify A Numoer, Equal"' To Tne Numoer of unspecified Pointers ot 
the Hash-Table-Balancing Bit Selection Vector, Of Potential, *R,* 
Columns As Actual, *K," Hash-Table-Balancing Bit Selection Vector 

Pointer Indication Columns, Whose Columns' Corresponding Bit 
Positions In The Respective Fields From Which The Respective Bit 
Strings Were Constructed Will Thereafter Be Pointed at by Pointers 
of f hfi Ha.gh-TahlP-Bal anring Bit- Selection Vpct-or 
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^ Stop ^ 
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C 



Specify All Potential, "P" or "R, " Columns As Actual, "K, " Hash- 
Table-Balancing Bit Selection Vector Pointer Indication Columns, 
Whose Columns' Corresponding Bit Positions In The Respective 
Fields From Which The Respective Bit Strings Were Constructed Will 
Thereafter Be Pointed at by Pointers of the Hash-Table-Balancing 
Bit Selection Vector 



Subtract Number of Actual, "K, " Hash-Table-Balancing Bit Selection 
Vector Pointer Indication Columns Just Specified From "Number of 
Unspecified Pointers of the Hash-Table- Balancing Bit Selection 

Vector" 
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^ Start ^ — |^ 



Obtain 
Complete, 
Ordered, ACL 



1 



OH 



Create Hash Table Having 
Number Of Entries 
Corresponding To The 
Specified Bit Length Of The 
hash Table Index 



Set "Rule Under Consideration" To Be First Rule In The ACL 



wot 



Using Hash-Table-Balancing Bit Selection 
Vector, Examine Bit Positions Of The Packet 

Header Fields Utilized By The Rule Under 
Consideration Which Are Pointed At by Hash- 
Table-Balancing Bit Selection Vector 
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Use The Bit Values Contained Within The 
Examined Bit Positions Of The Fields 
Utilized By The Rule Under Consideration, 
Construct a Hash Table Index Value To "Key 
Into" A Row Of The Created hash table 



For The Rule Under Consideration, Examine From Left To Right The 
Fields Utilized By The Rule Under Consideration, Construct A Binary 
comparison tree Entry For Each Such Field Utilized 
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H9^ 



At The Hash Table Entry Which Was "Keyed Into" Utilizing The Hash 
Table Index Value Constructed for the Rule Under Consideration, 
Append The Binary Comparison Tree Constructed for the Rule Under 
Consideration 




Set Rule Under 
Consideration 
To Be The Next ACL Rule 
Sequentially Appearing 
In The ACL 



FIG. 4 



Designate Constructed 
Table to be a Balanced 
Hash Table of ABCTs 



^ stop ^y 1 ^ 
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Insert Protocol Compare Node 
Having Miss and Match 
Branches Consistent With 
Protocol Field of Rule Under 
Consideration 



-No- 




Yes 




Insert Source Address Compare 
Node Having Miss and Match 
Branches Consistent With 
Source Address Field of Rule 
Under Consideration 



Insert Source Port Compare 
Node Having Miss and Match 
Branches Consistent With 
Source Port Field of Rule 
Under Consideration 



Yes- 



2- 



Insert Destination Address 
Compare Node Having Miss and 
Match Branches Consistent 
With Destination Address 
Field of Rule Under 
Consideration 




Insert Destination Port 
Compare Node Having Miss and 

Match Branches Consistent 
With Destination Port Field 
of Rule Under Consideration 



Insert Stop Node Having Miss 
and Match Branches Consistent 
With Final Dispensation of 
Rule Under Consideration 



Insert Stop Node Having Miss 
and Match Branches Consistent 
with Final Dispensation of 
Rule Under Considerat ion 



FIG. 



^ stop 



New Compare Node Potnter ts set to poml to the leftmost node 
of the binary comparison tree for the rule under consideration; 
New Compare Node Field Type is set equal to the type of field 

utilized by the node pointed to by the New Compare Node 
Pointer 



Uld compare Node Pointer is set. to Uie leftmost node (or root) or 
the pre-existing binary comparison tree already present at the hash 
index; Old Compare Node Field Type is set equal to the type of 
field utilized by the node pointed at by the Old Compare Node 

Pinter 



Binary comparison tree is 
appended in its entirety at the 
hash table entry associated with 
the hash table index, with the 
leftmost node of Binary 
comparison tree serving as root of 
the tree 




New Stored Node Pointer is set to be 
equal to the New Compare Node 
Pointer 



Old Stored Node Pointer is set to be 
equal to Old Compare Node Potnter 




Next New Node Potnter is set to point to the node at 
the end of the match branch of the node pointed to 
by the New Compare Node Potnter (i.e., the next 
node on the match branch of the binary comparison 
tree for the rule under consideration) 



New Compare Node Pointer is reset to be equal to 
the Next New Node Pointer 



Next Old Node Pointer is set to point to the node at the 
end of the match branch the node pointed to by the Old 
Compare Node Pointer 



Yes- 



Next Old Node Potnter is set to point to the 
node at the end of the miss branch of the 
node pointed to by the Old Compare Node 
Pointer 



Next Old Node Pointer is set to 
point to the node at the end of 

the miss branch of node 
pointed to by the Old Compare 
Node Pointer (i.e., the next 
node on the match branch of 
the binary comparison tree for 
the Pre-Existing tree at hash 
table index) 



Old Compare Node 
Potnter is reset to be 
equal to the Next Old 
Node Pointer 



Next Old Node Pointer is set to point 
to the node at the end of the 
MATCH branch of Old STORED 
Node (we are doing this because if 
the field type does not match, part of 
the binary comparison tree created 
for the rule under consideration must 
be appended to both the miss and 
match branch of the pre-existing 
hash table tree since the ACL 
Rule(s) encoded by the pre-existing 
hash table tree do not utilize the field 
type which is utilized by the binary 
tree constructed for the current rule 
under consideration) 



Add tree residual, starting from the node of the binary 

comparison tree for the rule under consideration, 
pointed at by New Compare Node Pointer, at the end 
of the miss branch of the Old Compare Node, which ts 
a node in the Hash Table Tree; that is. the node 
having a value equating to a stop node is replaced 
with the remainder of the binary tree for the rule under 
consideration, where the first replacement node is that 
node pointed at by the New Compare Node Pointer 



Old Compare Node Value is 
reset to be the value of the 
Next Old Node Pointer 



Yes 



The node on the miss branch of node pointed to 
by Old Compare Node Pointer is replaced with 
the node pointed at by New Compare Node 
Pointer (i.e., the New Compare Node Value is 
appended onto the Pre-Existing Binary 
comparison tree) 



Old Compare Node Pointer is reset to 
equal the Next Old Node Pointer 



Fig. 6 
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Default Deny Node Value is appended to the 
miss branch of the node just appended to the 

pre-existing hash table tree (i.e., the node 
pointed to by the New Compare Node potnter) 
as was discussed in preceding method step 



I 



^ stop 
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The New Compare Node Pointer is set to point to the 
node pointed at by the New Stored Node Pointer — the 
reason that this pointer is not advanced at this method 

step is that now the process is going to append at 
least part of the binary rule under consideration to the 
match branch of the pre-existing tree where the field 
types did not match 



Add tree residual, starting from the node of the binary 

comparison tree for the rule under consideration, 
pointed at by New Compare Node Pointer, at the end 
of the match branch of the Old Compare Node, which 
is a node in the Hash Table Tree; that is, the node 
having a value equating to a stop node is replaced 
with the remainder of the binary tree for the rule under 
consideration, where the first replacement node is that 
node pointed at by the New Compare Node Pointer 
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